Accident Management Plan (AMP) — One Framework from Design Basis Accidents to Severe Accidents

Principle and mechanism

"Accident management" means all measures taken when an accident occurs to prevent it from escalating, mitigate its consequences and return the facility to a safe state (including severe accident management). Internationally, the framework is described in IAEA SSG-54 (2019), Accident Management Programmes for Nuclear Power Plants, and builds on the design extension conditions (DEC) of IAEA SSR-2/1 Rev. 1 (2016).

From voluntary guidelines to a regulated plan

Severe accident management began in many countries as voluntary operator practice. In the United States, severe accident management guidelines (SAMG) were introduced as an industry initiative (NEI 91-04, 1990s) and remain so; after the Fukushima accident (2011), 10 CFR 50.155 (2019) made mitigation of beyond-design-basis events (FLEX equipment, spent fuel pool instrumentation and related measures) a regulatory requirement. Some countries went further and made accident management as a whole a licensing document with quantitative acceptance criteria.

Four categories of accident management scope

A comprehensive plan covers four categories of accident:

1. Design basis accidents: the FSAR Chapter 15 accidents, already confirmed in the licensing safety analysis.
2. Accidents caused by multiple failures: a defined list of events plus additional events identified by PSA. These go beyond the single-failure criterion and are design extension conditions in character.
3. Natural and intentional hazards exceeding the external factors considered in design: natural hazards such as geological/seismic, meteorological and hydrological/oceanographic phenomena; terrorism such as intentional aircraft impact; and combined hazards caused by these.
4. Severe accidents (significant core damage): covering the threats to containment integrity that follow.

Typical multiple-failure events

1. Anticipated transient without scram (ATWS)
2. Station blackout (SBO)
3. Multiple steam generator tube rupture
4. Total loss of feedwater
5. Interfacing-systems LOCA (ISLOCA)
6. Loss of shutdown cooling
7. Loss of the ultimate heat sink
8. Small LOCA with simultaneous loss of safety injection or recirculation
9. Loss of spent fuel pool cooling

Additional events are those assessed by PSA or other means to have a similar level of likelihood and consequence to the listed events.

Plant conditions to assume after external hazards

For beyond-design-basis external hazards, bounding plant conditions are assumed rather than a specific damage scenario, for example:

• Natural and combined hazards: long-term loss of AC power and of the ultimate heat sink
• Intentional and combined hazards: loss of main control room functions and of all power, and loss of all cooling except primary-side cooling using a single steam generator per coolant loop

Threats to containment after significant core damage

1. Combustion or explosion of combustible gases
2. Containment high temperature or overpressure
3. Molten core–concrete interaction (MCCI)
4. High-pressure melt ejection (HPME)
5. Direct containment heating (DCH)
6. Fuel–coolant interaction (FCI)
7. Containment bypass such as steam generator tube creep rupture

Additional threats are chosen by the same PSA criterion.

Assessing accident management capability

Quantitative risk targets differ between regulators. For example, US NRC guidance uses a core damage frequency of 10⁻⁴/yr and a large early release frequency of 10⁻⁵/yr (RG 1.174), while CDF 10⁻⁵/yr (INSAG-12) and a large release frequency of 10⁻⁶/yr are commonly used targets for new-plant design PSA.

What it means in a plant

Structure of the plan

The strategy chain runs "target accident → goal → essential safety functions → strategy → procedures and guidelines". Multiple failures are implemented in abnormal and emergency operating procedures, external hazards in extreme-hazard mitigation guidelines (in the United States, FLEX-type strategies with portable equipment), and severe accidents in the SAMG.

Regulatory and design criteria

Approaches differ: the United States leaves SAMG to industry initiative and mandates FLEX and similar measures by regulation, whereas some regulators make the whole accident management plan a licensing document with scope, assessment criteria and quantitative risk targets written into regulation.

Easily confused pairs

The hierarchy matters: the plan is the top level; procedures and guidelines are the means of implementation. Common mix-ups are "AMP = SAMG" (the SAMG is a lower-level guideline implementing the plan's severe accident strategy), "multiple failures = design basis accident + single failure" (they are combinations beyond the single-failure criterion), and counting the radiological emergency plan as one of the four categories (it is a separate document).

Key points at a glance

1. Definition: top-level plan for accident management (including severe accident management), covering scope, equipment, strategies and implementation, capability assessment, and education and training.
2. International framework: IAEA SSR-2/1 Rev. 1 (design extension conditions) and SSG-54 (accident management programmes); in the United States, 10 CFR 50.155 plus industry SAMG.
3. Four scope categories: design basis accidents, multiple-failure accidents, external hazards beyond the design basis, severe accidents.
4. Typical multiple failures: ATWS, SBO, multiple SG tube rupture, total loss of feedwater, ISLOCA, loss of shutdown cooling, loss of ultimate heat sink, SBLOCA + loss of SI/recirculation, loss of SFP cooling + PSA additions.
5. Containment threats: hydrogen combustion, high temperature and overpressure, MCCI, HPME, DCH, FCI, SG creep bypass + PSA additions.
6. Assessment: prevention (no significant fuel damage, functions restored), mitigation (containment barrier kept), deterministic consequences, PSA risk.
7. Implementation: EOPs for multiple failures, extreme-hazard mitigation guidelines for external hazards, SAMG for severe accidents.